The UK’s data protection legislation is now set out in the Data Protection Act 2018 and UK General Data Protection Regulation. Like the previous legislation, consent is not the only lawful ground on which processing of personal data can occur. For example, it might be necessary for organisations to process data for public interest reasons, such as crime prevention or safeguarding, without seeking the consent of the individual first. Similarly, there may be some non-intrusive commercial activities that customers may reasonably expect organisations to take without seeking their specific consent.

We are taking steps in the Data Protection and Digital Information (No. 2) Bill to reform aspects of the current legislation. Where processing of personal data is based on a person’s consent, the Bill will not make any changes to the rules which require consent to be freely given, specific and informed. The Bill will make some changes to existing record-keeping requirements which can place unnecessary burdens on small businesses in particular. In the future, organisations will only have to keep records of their processing activities if their processing activities are likely to pose high risks to the rights and freedoms of individuals. This will help to make sure that organisations are not spending disproportionate amounts of time and resources on unnecessary paperwork.

The Information Commissioner’s Office (ICO) is an independent regulator. Funding for data protection activities is provided by the data protection charges, which are levied on data controllers in accordance with the Data Protection (Charges and Information) Regulations 2018 (previously the Data Protection (Notification and Notification Fees) Regulations 2000). The collection of the data protection charge (and previously the notification fee) is the responsibility of the ICO. The Data Protection Act 2018 sets out powers for the ICO to enforce collection of these charges, including penalties up to a maximum of 150% of the highest charge payable by a controller in that year (Part 5 section 158). The ICO is at liberty to use all funding generated by these charges for data protection activity.

As a body funded by public money, the ICO is subject to standard Cabinet Office Spend Controls and HMT’s Managing Public Money principles. Full details on the controls pertaining to the ICO’s expenditure are available in the Management Agreement between the ICO and DCMS.

Under the terms of this Management Agreement, the ICO is able to retain such funds as are necessary to meet any liabilities at the end of the financial year (such as creditors), or unspent funds up to a maximum of 3% of total annual data protection charge income (whichever is the greater). Any additional surplus would be remitted to the Consolidated Fund at the end of the financial year. This is the only scenario in which income from data protection charges would be remitted to the Consolidated Fund. As such, the data protection charge (previously notification fee) is not collected for the benefit of the Consolidated Fund, but rather to ensure the ICO is able to fulfil its important regulatory functions.

Information on the amount of surplus remitted to the Consolidated Fund is not available for 2008/09 or 2009/10. For 2010/11 and 2011/12, this information is published on page 50 of the 2011/12 Annual Accounts. From 2012/13 onwards, this information is available in note 5b of the ICO’s Annual Accounts for each year. Copies of the Annual Accounts for each year are available on the ICO’s website www.ico.org.uk.

The Information Commissioner's Office (ICO) is responsible for regulating compliance with data protection legislation.

There are a number of tools available to the ICO to ensure compliance. These include criminal prosecution, non-criminal enforcement and audit. The Information Commissioner also has the power to serve a monetary penalty notice on a data controller. Further details of the actions which can be taken can be found on www.ico.org.uk.

The government's Data Protection Bill will strengthen legislation around data protection and give the Commissioner tougher powers to ensure that organisations comply.

I think that all apps should be compliant with the law, and I am delighted to say that the Matt Hancock app is.

What action does the Secretary of State think should be taken against an app that breaches key provisions of the Data Protection Act and the privacy and electronic communications regulations, and that is not GDPR—general data protection regulation—compliant?

IMPRESS has applied for its Standards Code to be included and the Secretary of State is currently considering this application.

IMPRESS has applied for its Standards Code to be included and the Secretary of State is currently considering this application.